JPH05173890A - Data protecting microprocessor circuit for portable data carrier - Google Patents

Abstract

PURPOSE: To inhibit the access to an illegal storing area through the execution of a user program in a data protective microprocessor for portable data carrier. CONSTITUTION: A comparator 21 compares the content of an address register 14 with that of an auxiliary register 22 and, when the address value in the register 14 is smaller than an address (w) in the register 22, the comparator 21 discriminates that a secondary program is performing access to an illegal storing area and outputs a signal. Another comparator 23 compares the content of a program counter PC with that of the register 24 and, when the content of the counter PC is equal to or larger than the value (w) in the register 24, the comparator 23 discriminates that the secondary program is being executed and outputs a signal. When both comparators 21 and 23 output signals, an AND gate 25 outputs a reset signal to a control unit 11 through a line 26 so as to inhibit the execution of the secondary program.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data protection microprocessor circuit, and more particularly to a data protection microprocessor which prohibits access to data or programs stored in memory.

[0002]

2. Description of the Prior Art Microprocessor circuits of the above type have been used in ID cards, credit cards and transcription cards (pos.
It is widely used in so-called chip cards equipped with integrated circuits such as ting cards). These microprocessor circuits can also be used for payment modules, etc., which interact with the above cards via a suitable interface.

In order to help understanding of the present invention, an example in which a microprocessor circuit is used for the card will be described.

A card with a microprocessor was first disclosed in German patent DE-OS 27 38113. One of the advantages of such a card is an effect that the usage range of the card owner is expanded. The microprocessor embedded in the integrated circuit or the card and the corresponding storage means enable the card itself to perform a wide range of data processing.
On the other hand, in a card to which a magnetic strip is attached, for example, all data processing functions need to be performed externally.

To this end, the card manufacturer can equip the microprocessor with a resident operating system which performs basic functions such as, for example, a procedure for comparing an externally entered code with a stored code. The storage device attached to the microprocessor stores not only the operating system, but also a specific application, a parameter essential for security check and the like, which requires complete protection.

[0006] It is started by an operating system equipped with a corresponding program, a specific interface is defined,
If the memory or memory area for so-called secondary programs is secured, the application range of the card will be further expanded. For this reason, card manufacturers provide users with a memory or storage area to program their own secondary programs.
I.e. card-issuing organization
Are provided to. The party may specify certain operations in secondary programs that are independent of the operating system and are only associated with a particular party.

In some cases, it is not only one organization that programs its own secondary program in a preformed chip card, but different organizations may each program their own programs.

In any case, it should be understood that the protection data that is part of the operating system or each secondary program is protected from unauthorized access.

[0009]

As described above, it is desirable that the configuration of the circuit that allows the secondary program to access only the memory area to which the explicit access is permitted is simple.

The present invention has been made in view of the above problems of the prior art, and its purpose is to protect an illegal memory area from being accessed even if a user program is executed. It is to provide a circuit with a simple configuration.

[0011]

In order to achieve the above object, the data protection circuit according to the first embodiment of the present invention comprises:
Consists of a first means for monitoring a specific selected address, a second means for monitoring a microprocessor program counter, and a third means for linking a signal from the monitoring means to generate a block signal. It is characterized by being.

A data protection circuit according to a second embodiment of the present invention is characterized by comprising a work microprocessor for executing a secondary program and a protection processor for monitoring the work processor. There is.

Further, the data protection circuit according to the third embodiment of the present invention has exactly the same address space except at least one top level, and further has a plurality of freely programmable storage areas. It is characterized by

[0014]

The data protection circuit of the present invention is configured as described above, and in the data protection circuit according to the first embodiment, since the read value of the program counter is monitored, the protection circuit Can always monitor which load program is currently running. Further, when the address called by a specific program being executed is being monitored at the same time, it is easy to illegally access the storage area by outputting a reset signal to the microprocessor, for example, via a coupling circuit. Can deal with

Although the protection circuit is separate from the actual microprocessor, it is preferably provided on an integrated circuit that takes up the microprocessor. Target values corresponding to specific program counter readings and addresses can be preset to allow or deny desired storage areas to specific users. When reading or writing of a particular storage area is selectively blocked, the read / write signal from the microprocessor will of course be processed in the protection circuit as well.

Further, in the data protection circuit of the present invention according to the second embodiment, the work processor is always under the control of the protection processor, so that the work processor operates every reset and executes the subsequent initialization. If the protection processor detects that the work processor executing a particular secondary program is accessing illegal storage, the protection processor is either an unmasked interrupt input of the work processor or resets. Output a block signal to the input terminal.

Since the protection processor monitors all steps of the work processor, it preferably operates at a higher clock frequency than the work processor.

When a plurality of secondary programs are stored in the memory corresponding to the work processor, it is necessary to prohibit access to other secondary programs as well as the operating system. The reference value required for this purpose is stored as a limit value in a limit memory corresponding to the protection processor. This memory corresponds to the protection processor and contains the address under monitoring and the limit value for the possible contents of the program counter of the working memory. The work processor's access to these memory areas is prohibited.

If an unauthorized access to the storage area is made, only a series of translatable instructions are executed to prevent execution of the secondary program. Next, the instruction of the secondary program is executed under the control of the operating system, and the access is performed only in the area where the access is permitted. In this way, the program counter of the microprocessor is not controlled by the secondary program.

Furthermore, according to a third embodiment of the present invention, a particular top level corresponding to a storage area is loaded into the auxiliary register before addressing the storage area. Whenever the data content of the auxiliary register changes, a block signal is output. For each load operation of the auxiliary register, the microprocessor defines a particular user. If this user accesses the illegal storage area and the content of the auxiliary register changes accordingly,
The protection circuit, which monitors the contents of the auxiliary register, generates a block signal.

[0021]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A preferred embodiment of a data protection microprocessor according to the present invention will be described below with reference to the drawings.

FIG. 1 shows the structure of a data carrier such as a credit card 1 made up of an integrated circuit 5 having a visual data area 2, a name stripe 3, a terminal 6 and embedded therein. Here, the connector contacts 6 are arranged in two rows. Since the basic structure of such a card is well known, detailed description thereof will be omitted. Furthermore, such credit card usage patterns and data processing methods are also well known. Data is exchanged with a terminal such as an automatic drawer through the connector contact 6. The integrated circuit of the credit card implements the protection routines necessary to qualify the card user.

FIG. 2 shows a first embodiment of the integrated circuit incorporated in a credit card. The microprocessor 10 is connected to the memory array 30 via the control line 18.
It is composed of a control unit 11, a logical operation unit (ALU) 12, a register file 13, an address register 14, and a data register 15 connected to each other. The register of the register file 13 functions as a program counter, and the content of the counter specifies which address is accessed to fetch the instruction of the secondary program stored in the memory array 30. That is, this instruction causes a data item to be read from any address in the memory. Therefore, an address for designating which address is to be accessed at the next access to the storage area is stored in the address register 14. This address is output to the memory array 30 via the bus 17. Data written to or read from the memory 30 is supplied to the data register 15 through the data bus 16 and further sent from the data register 15 to the register of the register file 13.

The memory array 30 includes a read / write memory (RAM) 31 as shown.
And read-only memory (ROM) 32 and E ² PR
It is composed of OM33. These storage areas 31,
32 and 33 are included in the operating system (BS), and a part of the operating system includes protection-related data that requires complete confidentiality. In order to protect such data by means of the simplified embodiment shown in FIG. 2, all operating system (BS) storage areas 31, 32, 3 using a secondary program.
User access to 3 is blocked.

If the manufacturer provides an area in the operating system that is accessible to the user and thus does not store protection-related data, the protection circuit described below is applied to the remaining addresses in the operating system that need protection. It is necessary to use 20. A region of the operating system is made accessible to the secondary program by the user, and the user is allowed to access the secondary sequence in order to compare the entered sequence number with the sequence number stored protected in the operating system. Since the program can be used, writing to the secondary program by the user becomes easy.

The memory array 30 is also provided with a secondary program storage area 34. This secondary program can be loaded by a different party than the card manufacturer. Therefore, the secondary program loaded by the user occupies the position from w to x in the storage area,
On the other hand, the operating system occupies positions 0 to w-1 in the storage area.

The secondary program is composed of a special routine and data for confirming whether the service requested by the card holder, that is, the withdrawal of deposit can be permitted according to the deposit balance of the card holder. There is. After the card holder inserts the card into the machine, data exchange takes place between the machine and the microprocessor 10. When a specific routine is started and executed by the operating system, the secondary program stored in the storage area 34, for example, the program counter PC in the register file 13 set at the address w, further executes the calculation. As a result, the instruction of the secondary program stored in the first storage location of the storage area 34 is called.

Secondary programs are stored in the storage areas 31, 32, 3
A protection circuit 20 according to the present invention is provided in order to prevent access to the address in the address 3. This protection circuit is also provided in the microprocessor 10 and the memory array 30. All these components are constructed as a one-chip integrated circuit.

The protection circuit 20 includes a first comparator 21, a first auxiliary register (HRI) 22, a second comparator 23, a second auxiliary register (HRII) 24, an AND gate 25, and the A.
It is composed of an ND gate 25 and an output line 26 connecting the control circuit 11 of the microprocessor 10.

In the comparator 21, the address register 1
4 and the contents of the auxiliary register 22 are compared, while the comparator 2
In 3, the contents of the program counter and the auxiliary register 24 are compared.

The contents of the auxiliary registers 22, 24 can be pre-programmed by the manufacturer in the wiring logic. In addition, the operating system may be used during the initialization of the microprocessor to load this content from the protected memory into an auxiliary register.

The address w for starting the secondary program in the storage area 34 is loaded into the auxiliary register 22. Similarly, the value w is also stored in the auxiliary register 24. If the address stored in the address register 14 is less than the address w stored in the auxiliary register 22, (that is, the secondary program 0 to w
When accessing illegal memory locations up to -1), the comparator 21 outputs a signal. If the content of the program counter PC of the register file 13 is equal to or greater than the value w stored in the auxiliary register 24, the comparator 23 outputs a signal. In the latter case, the secondary program is running.

When both the comparators 21 and 23 output a signal, it means that the secondary program is being executed and an illegal address outside the address space of the secondary program is being accessed. At this time, AND gate 2
5 outputs a reset signal or the like to the control unit 11 via the line 26, and the subsequent execution of the secondary program is blocked.

The read / write signals from the microprocessor are also processed by the protection circuit 20 (see line 27) to selectively block read or write operations.

As another aspect of the embodiment shown in FIG. 2, it is possible to add a comparator corresponding to the auxiliary register when the storage area for the secondary program loaded by a different user is further present.

FIG. 3 shows a second embodiment of the invention. The work processor 110 corresponding to the memory array (PROM) 130 has substantially the same function as the microprocessor 10 corresponding to the memory array 30 of FIG.

Here, the protection circuit is a secondary processor, that is, the protection processor 120 having its own memory array 150.

The operation clock signal C1 determines the operating speed of the protection processor 120. The frequency of the timing signal is divided by n by the frequency dividing circuit 140, and the work processor 110 to which the output signal from the frequency dividing circuit 140 is input operates at a speed of only 1 / n of the protection processor 120.

The protection processor 120 is provided with a control unit 121 which outputs a reset signal to the work processor 110 when an access of a secondary program to an illegal storage area is detected. In order to perform such detection, the work processor 110 and the memory array 1
Address line 117 and control line 1 connecting 30
Eighteen monitors are performed, and the work processor program counter (PC) is also monitored.
For each secondary program, both the data on the address bus 117 and the contents of the program counter PC are compared with a specific limit value.

The memory array 130 for the work processor 110 is provided with a plurality of storage areas for different users, called user I and user II. As mentioned above, these secondary programs are uniquely loaded by a different party than the card manufacturer. The storage areas 134, 135, 136 of the memory array 130 are preferably composed of a non-volatile memory (eg, E ² PROM) or the like.

After the initialization, when the work processor 110 executes a specific secondary program, for example, a program stored in the storage area 134 of the user I, the protection processor 120 supplies the specific address signal and the program counter to the user. Compare with the corresponding limit value of. These limits are set as part of the protection processor 120 operating system by the memory array 150.
It is stored in. When executing the secondary program of the user I, etc., the contents of the program counter PC will only cover values in a specific range. Further, the address on the address bus 117 must correspond only to the value in this range. If there is a difference between the address and the value, the processor 120 is the work processor 1
A reset signal is output to 10 to prevent execution of the secondary program.

FIG. 4 shows a third embodiment of the invention, according to which the microprocessor 210
Compatible operating system memory 23
1 is provided separately from the storage areas 234, 235, 236. These storage areas retrieve secondary programs for three different users. Microprocessor 210 and memory or storage area 23
An address bus and a control bus connect between 4, 235 and 236.

The (PROM) storage areas 234 and 23
The address space for accessing 5, 236 comprises, for example, 16 bits, and the most significant 2 bits specify which memory or storage area is currently accessed. As a whole, the two most significant two bits are used for four memory or storage areas (00, 01, 10,
11) can be selected.

Before executing the secondary program, for example, from the operating system controlled by user-specific variables, a value consisting of 2 bits in the present embodiment is used as the protection circuit 2.
It is input to the first auxiliary register 222 (HRI) in 20. For example, if a secondary program in the memory 234 is executed and the memory has an address consisting of a bit combination of "01" at the most significant 2 bit position, the value "01" is the memory register. 222
Be stored in.

When the secondary program is executed, that is, when the first address is designated, the uppermost two positions of the address register pass through the address bus and the second auxiliary register (HR).
II) loaded into 223, auxiliary registers 222 and 2
Comparator 221 which compares the contents of 23 is activated by the corresponding control signal from the microprocessor. When the content of the auxiliary program 222 matches the content of the auxiliary register 223, the second program is operating only in the corresponding address space (storage area 234). When different addresses are accessed, the two most significant positions of the address signal change and the contents of the auxiliary register 223 also change. Such changes are detected by the comparator,
A reset signal is output to the microprocessor 210 via line 226.

[Brief description of drawings]

FIG. 1 is a schematic diagram of a data carrier with an integrated circuit.

FIG. 2 is a block diagram of an integrated circuit for a data carrier including a microprocessor, a memory and a block circuit.

FIG. 3 shows a block diagram of an integrated circuit for a data carrier with a work processor, a protection processor and a corresponding memory.

FIG. 4 is a block diagram of an integrated circuit for a data carrier including a microprocessor, a memory and a block circuit.

[Explanation of symbols]

 10 Microprocessor 11 Control Unit 12 Logical Operation Unit 13 Register File 14 Address Register 15 Data Register 16 Data Bus 17 Control Unit 18 Control Line 20 Protection Circuit 21 First Comparator 22 First Auxiliary Register 23 Second Comparator 24 Second Auxiliary Register 25 AND Gate 26 Output Line 30 Memory Array 31, 32, 33, 34 Storage Area 110 Work Processor 117 Address Bus 118 Control Line 120 Protection Processor 121 Control Unit 130 Memory Array 134, 135, 136 Storage Area 140 Divider 210 Micro Processor 220 Protection circuit 221 Comparator 222 First auxiliary register 223 Second auxiliary register 231 Operating system memory 234, 235, and 236 storage area

Claims (14)

[Claims] 1. Data stored in a memory comprising at least one microprocessor, a system operating memory, and at least one memory in which a secondary program can be individually and freely programmed. Alternatively, in a data protection microprocessor circuit which prohibits access to a program, a first means for monitoring a specific effective address, a second means for monitoring a specific content of a microprocessor program counter, and a monitoring means from the monitoring means. And a third means for linking signals to generate a block signal. 2. A protection circuit comprising said first, second and third means is provided in a wiring logic on a circuit having said microprocessor. Data protection microprocessor circuit. 3. Each of said monitoring means comprises an auxiliary register and a comparator, said auxiliary register comprising address target values (setpoints) and program counter read values (p
3. Data protection microprocessor circuit according to claim 1 or 2, characterized in that it has a plurality of rogram counter readings) and that said comparator is respectively connected to an auxiliary register and a program counter or address register of the microprocessor. 4. The data protection microprocessor circuit according to claim 1, wherein the linking means is an AND gate connected to the output terminal of the comparator. 5. The target value is held in an inaccessible area of the operating system, and is loaded into the auxiliary register during initialization of the microprocessor. 5. A data protection microprocessor circuit according to any one of claims 4 to 4. 6. The block signal from the link means is an interrupt input of the microprocessor.
nput) end is connected.
6. A data protection microprocessor circuit according to claim 5. 7. The data protection microprocessor circuit according to claim 1, wherein the block signal from the link means is connected to a reset input terminal of the microprocessor. 8. The data protection microprocessor circuit according to claim 1, wherein the protection circuit is a second microprocessor called a protection processor. 9. The protection processor and the microprocessor, which is called a work processor that controls the secondary program, are provided on the same integrated circuit. Data protection microprocessor circuit as described. 10. The data protection microprocessor circuit according to claim 1, wherein the protection processor operates at a higher clock frequency than the work processor. 11. The protection processor is connected to a limit memory, and the limit memory stores a monitoring address and a limit value regarding a possible contents of a program counter of the work processor, and the limit value is stored in the memory. A data protection microprocessor circuit according to any one of the preceding claims, characterized in that the work processor is inaccessible. 12. The data or program stored in the memory is provided with at least one microprocessor, a memory for an operating system, and at least one memory in which a free program can be individually executed for each secondary program. In a data protection microprocessor circuit that prohibits access to multiple memory areas, the memory area corresponds to the memory area before addressing the memory area and a plurality of freely programmable memory areas that have the same address space except at least the topmost one. A data protection microprocessor circuit, which comprises a auxiliary register loaded with a specific highest level, and outputs a block signal when the contents of the auxiliary register change. 13. The data protection microprocessor circuit according to claim 12, wherein the top of the address bus is loaded into one or more auxiliary registers connected to the comparator. 14. The data protection microprocessor circuit according to claim 1, wherein a read / write signal from the microprocessor is processed in the protection circuit to selectively block reading or writing.